Skip to content

Commit c35530c

Browse files
lacatoirelacatoire
authored
Add new questions for Security and Storage domains (#54)
Security (+34 questions): - docker_bench_security.yaml: Docker Bench for Security (8) - seccomp_profiles.yaml: seccomp profiles (6) - apparmor_selinux.yaml: AppArmor/SELinux (6) - docker_secrets.yaml: secrets management (8) - readonly_containers.yaml: read-only containers (6) Storage & Volumes (+26 questions): - tmpfs_mounts.yaml: tmpfs mounts (6) - storage_driver_comparison.yaml: storage driver comparison (8) - system_cleanup.yaml: docker system df/prune (6) - volume_plugins_nfs.yaml: volume plugins and NFS (6)
1 parent a03d332 commit c35530c

File tree

10 files changed

+549
-0
lines changed

10 files changed

+549
-0
lines changed

‎README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,11 @@ The goal is to help candidates:
108108
* [Describe and demonstrate how to configure RBAC with UCP.](data/5_Security/ucp_rbac_config.yaml)
109109
* [Describe and demonstrate how to integrate UCP with LDAP/AD.](data/5_Security/ucp_ldap_ad_integration.yaml)
110110
* [Describe and demonstrate how to create UCP client bundles.](data/5_Security/ucp_client_bundle.yaml)
111+
* [Describe Docker Bench for Security.](data/5_Security/docker_bench_security.yaml)
112+
* [Describe seccomp profiles.](data/5_Security/seccomp_profiles.yaml)
113+
* [Describe AppArmor and SELinux with Docker.](data/5_Security/apparmor_selinux.yaml)
114+
* [Describe Docker secrets management.](data/5_Security/docker_secrets.yaml)
115+
* [Describe read-only containers.](data/5_Security/readonly_containers.yaml)
111116

112117
### Domain 6: Storage and Volumes (10% of exam)
113118

@@ -120,6 +125,10 @@ The goal is to help candidates:
120125
* [Describe and demonstrate how storage can be used across cluster nodes.](data/6_storage_and_volumes/volume_cluster.yaml)
121126
* [Describe how to provision persistent storage to a Kubernetes pod using persistentVolumes.](data/6_storage_and_volumes/persistent_volumes.yaml)
122127
* [Describe the relationship between container storage interface drivers, storageClass, persistentVolumeClaim and volume objects in Kubernetes.](data/6_storage_and_volumes/relationship_storage_volume.yaml)
128+
* [Describe tmpfs mounts.](data/6_storage_and_volumes/tmpfs_mounts.yaml)
129+
* [Compare storage drivers.](data/6_storage_and_volumes/storage_driver_comparison.yaml)
130+
* [Describe docker system df and prune commands.](data/6_storage_and_volumes/system_cleanup.yaml)
131+
* [Describe volume plugins and NFS.](data/6_storage_and_volumes/volume_plugins_nfs.yaml)
123132

124133
## Contributions
125134

‎data/5_Security/apparmor_selinux.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
questions:
2+
- uuid: b4d2e8a1-c5f3-4976-9d07-6b1a3e7f2c89
3+
question: What type of access control do AppArmor and SELinux provide for Docker containers?
4+
answers:
5+
- { value: 'Discretionary Access Control (DAC)', correct: false }
6+
- { value: 'Role-Based Access Control (RBAC)', correct: false }
7+
- { value: 'Mandatory Access Control (MAC)', correct: true }
8+
- { value: 'Attribute-Based Access Control (ABAC)', correct: false }
9+
help: https://docs.docker.com/engine/security/apparmor/
10+
11+
- uuid: e7f1c3b5-a2d4-4868-b9e0-8d6a1f5c4b27
12+
question: What is the name of the default AppArmor profile that Docker applies to containers?
13+
answers:
14+
- { value: 'docker-apparmor', correct: false }
15+
- { value: 'container-default', correct: false }
16+
- { value: 'docker-default', correct: true }
17+
- { value: 'apparmor-docker-profile', correct: false }
18+
help: https://docs.docker.com/engine/security/apparmor/
19+
20+
- uuid: 9a5b1d8e-f4c2-4637-a0b3-7e6d3c1f9a45
21+
question: Which flag is used to specify a custom AppArmor profile when running a Docker container?
22+
answers:
23+
- { value: '--apparmor-profile=<profile>', correct: false }
24+
- { value: '--security-opt apparmor=<profile>', correct: true }
25+
- { value: '--cap-add apparmor=<profile>', correct: false }
26+
- { value: '--mac-profile=<profile>', correct: false }
27+
help: https://docs.docker.com/engine/security/apparmor/
28+
29+
- uuid: 2c8f4a6d-b1e3-4d59-87b0-5e9a3d7c1f62
30+
question: How do you apply SELinux label options to a Docker container at runtime?
31+
answers:
32+
- { value: '--selinux=<label>', correct: false }
33+
- { value: '--security-opt label=<option>', correct: true }
34+
- { value: '--mac-opt selinux=<label>', correct: false }
35+
- { value: '--label-security=<option>', correct: false }
36+
help: https://docs.docker.com/engine/security/
37+
38+
- uuid: 6e3d1b7a-c8f2-4a15-9d04-0b5f8e2c4a93
39+
question: What is the key difference between Mandatory Access Control (MAC) and Discretionary Access Control (DAC)?
40+
answers:
41+
- { value: 'DAC policies are enforced by the kernel and cannot be overridden by users', correct: false }
42+
- { value: 'MAC policies are enforced by the system regardless of user permissions, while DAC allows resource owners to set permissions', correct: true }
43+
- { value: 'MAC is only available on Windows systems, while DAC is Linux-specific', correct: false }
44+
- { value: 'There is no difference; they are interchangeable terms', correct: false }
45+
help: https://docs.docker.com/engine/security/apparmor/
46+
47+
- uuid: f1a9c5d3-e2b4-4786-b0e8-4d7a6f3c8b12
48+
question: What happens when you run a Docker container with --security-opt apparmor=unconfined?
49+
answers:
50+
- { value: 'The container uses the docker-default AppArmor profile', correct: false }
51+
- { value: 'The container runs without any AppArmor profile applied', correct: true }
52+
- { value: 'The container is blocked from starting', correct: false }
53+
- { value: 'AppArmor applies the most restrictive profile available', correct: false }
54+
help: https://docs.docker.com/engine/security/apparmor/

‎data/5_Security/docker_bench_security.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
questions:
2+
- uuid: 7a3e1f4b-92d8-4c6a-b5e7-1d8f3a2c9b04
3+
question: What is Docker Bench for Security?
4+
answers:
5+
- { value: 'A Docker image scanning tool for CVEs', correct: false }
6+
- { value: 'A script that checks for best practices around deploying Docker containers in production based on the CIS Docker Benchmark', correct: true }
7+
- { value: 'A firewall configuration utility for Docker networks', correct: false }
8+
- { value: 'A performance benchmarking tool for Docker containers', correct: false }
9+
help: https://docs.docker.com/engine/security/
10+
11+
- uuid: 3b2d8e6f-a1c4-4f9b-87e5-6c0d4a3f1e28
12+
question: How is the docker-bench-security tool typically executed?
13+
answers:
14+
- { value: 'By installing it as a Docker plugin', correct: false }
15+
- { value: 'By running it as a Docker container with access to the Docker socket and system directories', correct: true }
16+
- { value: 'By compiling it from source on the host', correct: false }
17+
- { value: 'By enabling it in the Docker daemon configuration file', correct: false }
18+
help: https://docs.docker.com/engine/security/
19+
20+
- uuid: d4f6a8c2-5b1e-4d93-a0f7-9e3c2b8d1a56
21+
question: Which of the following is NOT one of the audit categories checked by Docker Bench for Security?
22+
answers:
23+
- { value: 'Host Configuration', correct: false }
24+
- { value: 'Docker Daemon Configuration', correct: false }
25+
- { value: 'Container Runtime', correct: false }
26+
- { value: 'Application Source Code Quality', correct: true }
27+
help: https://docs.docker.com/engine/security/
28+
29+
- uuid: 1e9b7c3a-8d4f-42a6-b5c1-0f6e2d8a4b79
30+
question: What standard does Docker Bench for Security use as its baseline for security checks?
31+
answers:
32+
- { value: 'NIST SP 800-53', correct: false }
33+
- { value: 'CIS Docker Benchmark', correct: true }
34+
- { value: 'OWASP Top 10', correct: false }
35+
- { value: 'PCI DSS v3.2', correct: false }
36+
help: https://docs.docker.com/engine/security/
37+
38+
- uuid: 8c5f2d1a-b3e7-4a69-9d06-7f4e1c8b3a25
39+
question: What does a WARN result in Docker Bench for Security output indicate?
40+
answers:
41+
- { value: 'The check was skipped because it does not apply', correct: false }
42+
- { value: 'The check passed with minor observations', correct: false }
43+
- { value: 'The configuration does not meet the CIS benchmark recommendation and should be remediated', correct: true }
44+
- { value: 'The Docker daemon needs to be restarted', correct: false }
45+
help: https://docs.docker.com/engine/security/
46+
47+
- uuid: 5a4e9b7d-c2f1-4683-b8d0-3e6f1a8c2d47
48+
question: Which Docker Bench for Security section audits settings such as restricting network traffic between containers and configuring TLS authentication?
49+
answers:
50+
- { value: 'Container Images and Build File', correct: false }
51+
- { value: 'Host Configuration', correct: false }
52+
- { value: 'Docker Daemon Configuration', correct: true }
53+
- { value: 'Docker Swarm Configuration', correct: false }
54+
help: https://docs.docker.com/engine/security/
55+
56+
- uuid: f2c8b1d6-4a3e-4975-8e09-5d7a6c1f0b93
57+
question: What type of checks does Docker Bench for Security classify as "manual" rather than "automated"?
58+
answers:
59+
- { value: 'Checks that require human judgment or organizational policy review', correct: true }
60+
- { value: 'Checks that must be run on Windows hosts only', correct: false }
61+
- { value: 'Checks that require the Docker daemon to be stopped', correct: false }
62+
- { value: 'Checks that are only available in Docker Enterprise', correct: false }
63+
help: https://docs.docker.com/engine/security/
64+
65+
- uuid: 6d1a3f8e-b5c2-4d07-9a4b-2e7c0f9d5b16
66+
question: Which of the following is a host configuration recommendation checked by Docker Bench for Security?
67+
answers:
68+
- { value: 'Ensure that the Docker socket is exposed on TCP port 2375', correct: false }
69+
- { value: 'Ensure containers run with the --privileged flag', correct: false }
70+
- { value: 'Ensure auditing is configured for Docker files and directories', correct: true }
71+
- { value: 'Ensure all containers use the host network mode', correct: false }
72+
help: https://docs.docker.com/engine/security/

‎data/5_Security/docker_secrets.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
questions:
2+
- uuid: 4b7e2d1a-c8f3-4a56-9e0b-5d6a1f3c8e27
3+
question: In which Docker mode are Docker secrets available?
4+
answers:
5+
- { value: 'Standalone mode only', correct: false }
6+
- { value: 'Docker Compose standalone only', correct: false }
7+
- { value: 'Docker Swarm mode', correct: true }
8+
- { value: 'Any Docker mode without restrictions', correct: false }
9+
help: https://docs.docker.com/engine/swarm/secrets/
10+
11+
- uuid: 8d3a6f1e-b5c2-4e79-a4d0-2c9b7e5f1a38
12+
question: Where are Docker secrets mounted inside a container by default?
13+
answers:
14+
- { value: '/etc/secrets/', correct: false }
15+
- { value: '/var/lib/docker/secrets/', correct: false }
16+
- { value: '/run/secrets/', correct: true }
17+
- { value: '/opt/docker/secrets/', correct: false }
18+
help: https://docs.docker.com/engine/swarm/secrets/
19+
20+
- uuid: e1c5b9a3-d4f2-4867-80b1-6e3a7d2f5c94
21+
question: What is the maximum size of a Docker secret?
22+
answers:
23+
- { value: '256 KB', correct: false }
24+
- { value: '500 KB', correct: true }
25+
- { value: '1 MB', correct: false }
26+
- { value: '5 MB', correct: false }
27+
help: https://docs.docker.com/engine/swarm/secrets/
28+
29+
- uuid: 3f9d7b2e-a1c4-4538-b6e0-8d5a2c7f1e43
30+
question: Which command is used to create a Docker secret from a file?
31+
answers:
32+
- { value: 'docker secret add my_secret ./secret.txt', correct: false }
33+
- { value: 'docker secret create my_secret ./secret.txt', correct: true }
34+
- { value: 'docker secret new my_secret --file ./secret.txt', correct: false }
35+
- { value: 'docker swarm secret create my_secret ./secret.txt', correct: false }
36+
help: https://docs.docker.com/engine/swarm/secrets/
37+
38+
- uuid: 7a2e4c8b-d6f1-4359-b0a7-1e5d3f9c2b76
39+
question: Why are Docker secrets considered more secure than environment variables for sensitive data?
40+
answers:
41+
- { value: 'Environment variables are encrypted while secrets are not', correct: false }
42+
- { value: 'Secrets are stored encrypted in the Raft log and only mounted in-memory to authorized services, while environment variables can be exposed via inspect commands and logs', correct: true }
43+
- { value: 'Secrets can only be accessed by manager nodes', correct: false }
44+
- { value: 'There is no security difference between them', correct: false }
45+
help: https://docs.docker.com/engine/swarm/secrets/
46+
47+
- uuid: c5b1d8f3-e2a4-4796-9d07-4a6e3b7c1f58
48+
question: How do you grant a running Swarm service access to a new secret?
49+
answers:
50+
- { value: 'docker secret attach <secret> <service>', correct: false }
51+
- { value: 'docker service update --secret-add <secret> <service>', correct: true }
52+
- { value: 'docker service secret add <secret> <service>', correct: false }
53+
- { value: 'docker secret grant <secret> --service <service>', correct: false }
54+
help: https://docs.docker.com/engine/swarm/secrets/
55+
56+
- uuid: 9e4a2f6d-b3c1-4857-a0e8-7d5b1c8f3a29
57+
question: What happens to a Docker secret when you run docker secret inspect on it?
58+
answers:
59+
- { value: 'It displays the full secret value in plaintext', correct: false }
60+
- { value: 'It shows metadata about the secret such as ID, name, and creation date, but not the secret data itself', correct: true }
61+
- { value: 'It decrypts and prints the secret in base64', correct: false }
62+
- { value: 'It removes the secret from the Swarm cluster', correct: false }
63+
help: https://docs.docker.com/engine/swarm/secrets/
64+
65+
- uuid: 2d8f5b1c-a3e7-4694-b0d2-6e9a4c7f3b15
66+
question: How is secret rotation typically handled in Docker Swarm?
67+
answers:
68+
- { value: 'Secrets are automatically rotated every 24 hours', correct: false }
69+
- { value: 'You create a new version of the secret, update the service to remove the old secret and add the new one', correct: true }
70+
- { value: 'You edit the secret in-place using docker secret update', correct: false }
71+
- { value: 'Secrets cannot be rotated once created', correct: false }
72+
help: https://docs.docker.com/engine/swarm/secrets/#example-rotate-a-secret

‎data/5_Security/readonly_containers.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
questions:
2+
- uuid: d6b3e1f8-c4a2-4957-8d0b-7e5a3c9f1b24
3+
question: What does the --read-only flag do when used with docker run?
4+
answers:
5+
- { value: 'Prevents the container from reading environment variables', correct: false }
6+
- { value: 'Blocks all network read operations', correct: false }
7+
- { value: "Mounts the container's root filesystem as read-only", correct: true }
8+
- { value: 'Makes all mounted volumes read-only', correct: false }
9+
help: https://docs.docker.com/engine/reference/run/#read-only
10+
11+
- uuid: a2f8d4b1-e6c3-4a75-9b07-1d5e8c3f7a92
12+
question: How can you allow a read-only container to write to a specific directory?
13+
answers:
14+
- { value: 'Use --writable-dir to specify the directory', correct: false }
15+
- { value: 'Use --tmpfs to mount a writable tmpfs filesystem at that path', correct: true }
16+
- { value: 'Read-only containers cannot write to any directory', correct: false }
17+
- { value: 'Use --read-only=partial to allow selective writes', correct: false }
18+
help: https://docs.docker.com/engine/reference/run/#read-only
19+
20+
- uuid: 5c9e1a7d-b2f4-4386-80d3-6a8b3e1f5c47
21+
question: Which command runs a container with a read-only root filesystem and a writable /tmp directory?
22+
answers:
23+
- { value: 'docker run --read-only --writable /tmp myimage', correct: false }
24+
- { value: 'docker run --read-only --tmpfs /tmp myimage', correct: true }
25+
- { value: 'docker run --immutable --allow-write /tmp myimage', correct: false }
26+
- { value: 'docker run --filesystem ro --exception /tmp myimage', correct: false }
27+
help: https://docs.docker.com/engine/reference/run/#read-only
28+
29+
- uuid: 8b4f2d6a-c1e3-4a58-97b0-3e7d5a9c1f82
30+
question: What is a key security benefit of running containers with a read-only root filesystem?
31+
answers:
32+
- { value: 'It encrypts the container filesystem', correct: false }
33+
- { value: 'It prevents attackers from modifying the container filesystem, such as installing malware or altering binaries', correct: true }
34+
- { value: 'It automatically enables AppArmor for the container', correct: false }
35+
- { value: 'It disables all Linux capabilities inside the container', correct: false }
36+
help: https://docs.docker.com/engine/reference/run/#read-only
37+
38+
- uuid: 1e7c3a5d-f8b2-4d96-a0b4-9d6e2f4c8b31
39+
question: What happens when a process inside a read-only container attempts to write to the root filesystem?
40+
answers:
41+
- { value: 'The write is silently discarded', correct: false }
42+
- { value: 'The container is automatically stopped', correct: false }
43+
- { value: 'The process receives a read-only filesystem error', correct: true }
44+
- { value: 'The write is redirected to a temporary overlay', correct: false }
45+
help: https://docs.docker.com/engine/reference/run/#read-only
46+
47+
- uuid: 4a9d6f2b-e3c1-4875-b8d0-5c7e1a3f9b64
48+
question: Which combination of flags provides a read-only container with writable directories for /tmp and /var/run?
49+
answers:
50+
- { value: 'docker run --read-only --tmpfs /tmp --tmpfs /var/run myimage', correct: true }
51+
- { value: 'docker run --read-only --volume /tmp --volume /var/run myimage', correct: false }
52+
- { value: 'docker run --read-only --writable /tmp,/var/run myimage', correct: false }
53+
- { value: 'docker run --immutable --except /tmp,/var/run myimage', correct: false }
54+
help: https://docs.docker.com/engine/reference/run/#read-only

‎data/5_Security/seccomp_profiles.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
questions:
2+
- uuid: a9d3e7b1-4c6f-4285-b0e8-2f5a1d8c3e97
3+
question: What does seccomp stand for in the context of Docker security?
4+
answers:
5+
- { value: 'Secure Composition', correct: false }
6+
- { value: 'Security Compliance', correct: false }
7+
- { value: 'Secure Computing Mode', correct: true }
8+
- { value: 'Secure Container Management Protocol', correct: false }
9+
help: https://docs.docker.com/engine/security/seccomp/
10+
11+
- uuid: 2f8c4b6e-d1a3-4e57-9b0d-7a5e3c1f8d29
12+
question: What does Docker's default seccomp profile do to containers?
13+
answers:
14+
- { value: 'It blocks all network access by default', correct: false }
15+
- { value: 'It restricts the set of system calls available to the container process', correct: true }
16+
- { value: 'It encrypts all filesystem operations', correct: false }
17+
- { value: 'It prevents containers from using environment variables', correct: false }
18+
help: https://docs.docker.com/engine/security/seccomp/
19+
20+
- uuid: 74e1a5c8-b3d2-4f96-80a7-9d6f2e4b1c53
21+
question: Which flag is used to apply a custom seccomp profile when running a Docker container?
22+
answers:
23+
- { value: '--cap-add seccomp', correct: false }
24+
- { value: '--seccomp-profile', correct: false }
25+
- { value: '--security-opt seccomp=<profile.json>', correct: true }
26+
- { value: '--profile seccomp=<profile.json>', correct: false }
27+
help: https://docs.docker.com/engine/security/seccomp/
28+
29+
- uuid: c3b7d9e2-1f5a-4c68-b4d0-8e6a2f3c7b15
30+
question: How do you disable the default seccomp profile for a Docker container?
31+
answers:
32+
- { value: '--security-opt seccomp=disabled', correct: false }
33+
- { value: '--security-opt seccomp=unconfined', correct: true }
34+
- { value: '--security-opt no-seccomp', correct: false }
35+
- { value: '--disable-seccomp', correct: false }
36+
help: https://docs.docker.com/engine/security/seccomp/
37+
38+
- uuid: 5e2a8d4f-c6b1-4397-a0e3-1b9f7d5c3a68
39+
question: Which of the following system calls is blocked by Docker's default seccomp profile?
40+
answers:
41+
- { value: 'read', correct: false }
42+
- { value: 'write', correct: false }
43+
- { value: 'clone (with CLONE_NEWUSER flag)', correct: true }
44+
- { value: 'open', correct: false }
45+
help: https://docs.docker.com/engine/security/seccomp/
46+
47+
- uuid: 18f6c4a9-d2e3-4b75-8c1a-0d7b5e9f2a46
48+
question: What format is used to define a custom seccomp profile for Docker?
49+
answers:
50+
- { value: 'YAML', correct: false }
51+
- { value: 'XML', correct: false }
52+
- { value: 'JSON', correct: true }
53+
- { value: 'TOML', correct: false }
54+
help: https://docs.docker.com/engine/security/seccomp/

0 commit comments

Comments
 (0)